To investigate this behavior, we perform the following experiment in Fig. REF . For random 1000 test set images from CIFAR-10, we evaluate the loss with additive Gaussian noise of \(\sigma \in [0, 0.1]\) 
and average the loss function over both images and perturbations for (1) a standard model, (2) a model trained with Gaussian augmentation with \(\sigma =0.05\)  where all 100% training samples are augmented, (3) a model trained with Gaussian augmentation for \(\sigma =0.1\)  where only 50% training samples are augmented, and (4) \(\operatorname{\mathbf {\ell }}_2\)  adversarially trained model with \(\varepsilon =0.1\) . We notice that the loss function for 100% Gaussian augmentation is minimal at \(\sigma \)  which is only slightly less than \(\sigma =0.05\)  used for its training. Hence, the model has overfitted not only to the type of noise but also to its magnitude. The loss function outside and inside of the sphere is bigger than on its surface. However, there is a simple fix if we train with 50% Gaussian noise in each batch, as suggested, e.g., in [1]} in contrast to [2]}. This scheme allows to alleviate the \(\sigma \) -overfitting behavior and also achieve better accuracy on clean samples (93.2% instead of 92.5%) and, most importantly, significantly improve on common corruptions (85.0% instead of 80.5%). At the same time, \(\operatorname{\mathbf {\ell }}_2\)  adversarial training does not suffer from this problem and both 100% and 50% schemes work nearly equally well (details can be found in App. ). We provide a further discussion on \(\sigma \) -overfitting in App.  together with additional experiments on ImageNet-100 where \(\sigma \) -overfitting has even more noticeable behavior.
<FIGURE>